Sequential monitor

ABSTRACT

A sequential monitor for comparing redundant signals appearing at various points in a control system and for providing an indication when the difference between the redundant signals exceeds a predetermined limit. The monitor is multiplexed in the system so that a single monitor suffices for comparing signals at all of the points and is fail safe in that it provides an indication for internal monitor malfunctions as well as for signal failures.

United States Patent 1 [111 3,708,791

Curran et al. 1 Jan. 2, 1973 [54] SEQUENTIAL MONITOR 3,492,589 1/1970Rotier ..340/248 A [75] Inventors: Peter F. Curran, Westchester Coun-3,579,120 5/1971 ty; David A. Tawfik, Queens Coun- 3,539,928 11/1970Gardner etal. ..328/104 ty, both of N.Y.; Robert L. James,

Bloomfield, NJ. Primary Examiner-Thomas B. Habecker AssistantExaminer-Robert J. Mooney [73] Asslgnee' The Bendix ConanAttorney-Anthony F. Cuoco and Plante, Hartz, Smith [22] Filed: Dec. 28,1970 and Thompson 21 Appl. No.: 101,646

[57] ABSTRACT A sequential monitor for comparing redundant signals [52]US. Cl ..340/248 A, 328/104, 328/147, appearing at various points in acontrol System and for 340/183 providing an indication when thedifference between Int Cl- "G081! the redundant signals exceeds apredetermined Fie Of Se The monitor is multiplexed in the system so thata sin- 3 /1 N, 150, 23/147, 1 gle monitor suffices for comparing signalsat all of the 340/147 L313, 2 points and is fail safe in that itprovides an indication for internal monitor malfunctions as well as forsignal References failures.

UNITED STATES PATENTS 10 Claims, 2 Drawing Figures 3,594,789 7/1971Rotier ..340/4l3 (d) 1 PULSE 27 SOURCE l3 elm- T 33 l5 MEL 1 E 8 Y S 2I8 2 w 1 9/5 A k F:

5 G 4 6 a k 3 17 i l9 fi l l 2 l 21 E3 0 so +B134L 48 24\ A AB B fine jl2 IS 44 28 30 4 33 155m 0/5 46 25 4 G -/27 -23 QIIIIH [4 42 40 at; FF DS Q R E7 1T1 i 36 a2 G E l l l f; 3e 34 LC) 58 l6 4'/I A III 54m D/s 2BSEQUENTIAL MONITOR BACKGROUND OF THE INVENTION 1. Field of the InventionThis invention relates to apparatus for sequentially monitoringredundant control signals and, more particularly, to apparatus of thetype described which provides fail safe monitoring with simplifiedcircuitry and increased accuracy.

2. Description of the Prior Art Prior to the present invention monitorsfor sequentially monitoring redundant signals at various points in acontrol system required separate circuitry for each monitored point.This requires additional power and increases the cost and complexity ofthe monitor. The device of the present invention eliminates thesedisadvantages since only a single monitor circuit is required.

SUMMARY OF THE INVENTION This invention contemplates a monitor wherein aplurality of pairs of redundant signals are sequentially applied to themonitor through a corresponding plurality of switches. If the signals inthe pair being monitored correspond within predetermined limits themonitor provides an alternating signal which operates a switch forapplying another pair of redundant signals to the monitor. If the limitsare exceeded, the monitor provides a steady state signal which isineffective for operating the switch and is effective for operating afailure indicator or a system disconnect device. The monitor is alsoeffective for deferring failure indication when a selected pair ofsignals fails and for providing said indication when another selectedpair of signals fails as well, whereupon the monitor provides an outputwhich inhibits all further sequencing.

One object of this invention is to provide a single monitor forcomparing pairs of sequentially applied redundant signals occurring atvarious points in a control system.

Another object of this invention is to provide a fail safe sequentialmonitor of the type described in that the monitor alarms for its ownfailures as well as for control signal failures.

Another object of this invention is to provide a monitor of the typedescribed having simplified circuitry, fewer components and increasedreliabilityas compared to monitors now known in the art.

Another object of this invention is to sequentially compare pairs ofredundant signals, and if a selected pair of redundant signals fails afailure indication is deferred until another selected pair of signalsfails, and whereupon all further sequencing is inhibited.

The foregoing and other objects and advantages of the invention willappear more fully hereinafter from a consideration of the detaileddescription which follows, taken together with the accompanying drawingwherein one embodiment of the invention is illustrated by way ofexample. It is to be expressly understood, however, that the drawing isfor illustration purposes only and is not to be construed as definingthe limits of the invention.

DESCRIPTION OF THE DRAWINGS FIG. 1 in the drawings is an electricalschematic diagram of a sequential monitor according to the invention.

FIG. 2 is a diagrammatic representation illustrating wave forms forreset pulse (b) and the output of decoder gate 33 shown in FIG. 1.

DESCRIPTION OF THE INVENTION A pair of signals E and E equal inmagnitude but opposite in polarity, appear at a point in, for example,an automatic flight control system and are to be monitored by the deviceof the present invention. Likewise, pairs of signals E E E,,, E-,; and EE,, are signals from other points in the automatic flight control systemand are also to be monitored. Signal E is a d.c. supply signal which isto be used for purposes hereinafter described.

Signals E and E and a d.c. signal from a source shown as a battery B areapplied to a monitor circuit 2 including amplifiers 4 and 6 through afield effect transistor switch 8 and signal E and a d.c. signal from asource shown as a battery B are applied to monitor 2 through a fieldeffect transistor switch 10. Signals E E and a d.c. signal from a sourceshown as a battery B signals E E and a d.c. signal from a source shownas a battery 3, and signals E E and a d.c. signal from a source shown asa battery 8,, are applied to monitor 2 through field effect transistorswitches 12, 14 and 16, respectively. Each of the transistor switches 8,10, 12, 14 and 16 have Drain (D), Source (S) and Gate (G) elements withthe respective drain elements receiving the applied signals and thesource elements connected to amplifier 4 in monitor 2.

Normally monitor 2 provides at the output of amplifier 6 therein, asquare wave signal shown in the figure and designated as (a). If thepair of signals being examined are faulty; that is if they do notcorrespond in magnitude within predetermined limits, then the outputprovided by amplifier 6, said amplifier being driven by pulses (d) froma pulse source 9, is a steady state signal instead of the normalalternating square wave signal (a). Resistors 3, 5 and a capacitor 8 areconnected to amplifier 4 and resistors 11, 15, 17, 19 and 23, d.c.sources 13 and 21 and zener diode 27 are connected to amplifier 6 toestablish proper circuit parameters and to modify the output ofamplifier 6 for purposes of the invention as will be understood by thoseskilled in the art.

Thus, amplifiers 4 and 6 and their associated circuitry provide, ineffect, a comparator. The output from battery B is a tracer output whichis combined by amplifier 4 with signals E and E If signals E and E,correspond within predetermined limits, the output of amplifier 4 is thetracer output, adjusted by the gain of the amplifier. If the signals donot correspond, the output from amplifier 6 is at some higher level. Thetracer output is required so that some output is always provided byamplifier 4 to indicate that the system is operating properly.

Amplifier 6 is in d.c. balance. If the input to amplifier 6 fromamplifier 4 is the aforenoted gain adjusted tracer output, a small d.c.unbalance occurs. Pulses (a) from pulse source 9 are sufficient toovercome this unbalance and amplifier 6 provides a square wave outputindicative that signals E and E, are normal. If, on the other hand, theinput to amplifier 6 is at the higher level, the pulses are insufficientto overcome the associated d.c. unbalance and amplifier 6 provides asteady state output indicative of faulty signals E and E The signal frommonitor 2 is applied to a counter 18 including dual flip-flops 20 and 22which are driven by a dc. source shown as a battery 27. Flip-flop 20provides A and A logic outputs which are applied as inputs to flip-flop22 and flip-flop 22 provides B and B logic outputs which are applied asinputs to flip-flop 20. Both flip-flops receive output (a) from monitor2 and are reset by a pulse designated as (b) in the figure.

If the signals being monitored correspond within predetermined limits,square wave signal (a) provided by monitor 2 is in effecta clock pulsewhich drives decoder 24 including four dual input gates 26, 28, 30 and32 connected to counter 18 outputs A, B; A, B; A, B and A, Krespectively, to provide a 1" output at corresponding output conductors23, 25, 27, and 29 for rendering an appropriate field effect transistorswitch conductive so that a new pair of signals is applied to themonitor for examination thereby. To this end conductor 23 is connectedto the gate element of transistor 8 through an inverter 46 and a gate 50and the gate element of transistor 10 is connected to an inverter 48 aswill be further explained. Conductor 25 is connected to the gate elementof transistor 12, conductor 27 is connected to the gate element oftransistor 14 and conductor 29 is connected to the gate element oftransistor 16.

If the signals being compared do not correspond with predeterminedlimits, counter 18 does not receive clock pulse (a) from monitor 2, butreceive instead the aforenoted steady state signal and therefore doesnot sequence to the next counter state. This means that decoder 24 doesnot provide the 1 output at conductors 23, 25, 27 and 29 to renderanother field effect transistor switch conductive and the previousswitch remains conductive indefinitely for sustaining application of thetwo faulty signals to the monitor, and whereupon the aforenoted steadystate signal is provided for actuating a failure indicator 31 which maybe a conventional type alarm bell or a system disconnect device 33 whichmay be a conventional type switch.

Sometime, in monitoring signals in a flight control system, it isdesired to defer a failure indication for one pair of faulty controlsignals until it is found that a second pair of control signals is alsofaulty. This may be considered as OR type monitoring since either onepair of inputs signals or the other pair is sufficient to provide anormal (a) monitor output.

The circuitry for accomplishing this latter monitoring includes anexclusive OR gate having inverters 32 and 34 connected to gates 36 and38, respectively. The inputs to OR gate 36 are square wave (a) frommonitor 2 and a reference square wave designated as (c) in the figure.

For purposes of illustration, if input signals E and E are faulty, asteady state output appears at the output of amplifier 6 in monitor 2 asheretofore noted. Gate 30, having gate 36 connected to the output ofamplifier 6 applies successive l and O outputs to a gate 40 coupled tothe output of gate 30 through a capacitor 41, since gate 30 no longerreceives dual square wave inputs with square wave input (a) beingabsent.

Gate 40 receives a l output from the 0 terminal of a flip-flop 42, andwhich flip-flop 42 is driven by a dc. signal from a battery 43 and resetby pulse (b) for providing said I output. Therefore, gate 40 goes firstto a 1 output and then to a 0 output, and drives flip-flop 42 to providea l output at its 0 terminal.

In this connection it is to be noted that reset pulse (b) occurs whengate 32 in decoder 24 provides an output pulse as shown in the timingdiagram of FIG. 2. The reset pulse is applied to flip-flops 20, 22 and42 which must be reset so that circuit operation is initially started ina definite state. The resetting of flip-flop 42, moreover, insures thatfield effect'transistor 8 is turned on in appropriate sequence.

The l output provided by flip-flop 42 is applied to gate 44 and inverter48 which is connected to gate 50. Gate 44 is connected to switch 10 asheretofore noted. Inverter 46 driven by gate 26 in decoder 24 isconnected to gate 50, and which gate is connected to the gate element oftransistor 8. Thus, when signals E E are faulty the action of gate 30,flip-flop 42 and gates 40, 44, 46, 48, 50 is to render transistor 8nonconductive to block signal E and E and to render transistor 10conductive to pass signal E for affecting amplifier 6 to provide analternating output and thereby preventing a sustained steady statefailure signal from being provided by the monitor.

If a comparison of another pair of signals shows another failure, ORgate 30 still sends l and 0 outputs to gate 40, but the output of gate40 remains a constant 1 since a constant 0 from flip-flop 42 controlsits action. Thus, the second failure stops all sequencing of the monitorloop and a sustained steady state failure signal is provided at theoutput of amplifier 6 in monitor 2.

If the second failure had not occurred, the output from amplifier 6would resume its normal square wave configuration, which in turn wouldsequence counter 18 thereby causing selection of the next pair ofsignals to be compared. If the first failure had not occurred, thecounter would sequence normally but would omit selection of the secondset of signals, the selection of which is outside its control.

As heretofore noted batteries B B B B and B are connected to the drainelements of transistor switches' 8, l0, l2, l4 and 16 respectively. Thebatteries apply constant level d.c. signals through the respectiveswitches to the monitor. The d.c. signals provide a balance, and whichbalance must be overcome for the monitor to trip and provide at theoutput of amplifier 6 a constant level (failure) output. In this respectprotection is provided against an erroneous failure signal when acomponent failure occurs such as one of the transistor switches beingfrozen closed. I

It will now be understood that the logic components shown in the figureare of the standard type and are commercially available. For example,the flip-flops included in counter 18 may be of the dual monolithic typeclocked JK flip-flops manufactured by the Fairchild SemiconductorCompany and carrying their trade designation DTa9094 as described in aFairchild Data Sheet, dated January 1967. Likewise flip-flop 42 may beone-half of component DTp.9094.

Gates 36, 38, 40, 44 and 50 and the gates included in decoder 24 may beof the Quad twoinput type manufactured by the Fairchild SemiconductorCompany and carrying the trade designation DTpL 946 as described in aFairchild Data Sheet, dated August 1964.

Inverters 32, 34, 46 and 48 may be of the type also manufactured by theFairchild Instrument Company and carrying the trade designation DTpL9936as described at pages 3-113 to 3-117 of a Fairchild SemiconductorIntegrated Circuit Data Catalog, 1970. It will be seen from the drawingand from the foregoing description thereof, that no component circuit inthe monitor loop has to be fail safe in itself since its failures willbe indicated by a change in the action of the entire monitor loop. Thisis a distinct advantage since otherwise the requirements of componentfail safe circuits not only limits the performance of the monitor butmakes it more complicated in configura' tion and more expensive tomanufacture.

In essence, then a fail safe characteristic by loop action has beensubstituted for fail safe design of individual component circuits. Also,an advantage is realized in that the same monitoring equipment is usedover and over by multiplexing instead of having a separate monitor atthe various points in the system which are to be monitored.

Although but a single embodiment of the invention has been illustratedand described in detail, it is to be expressly understood that theinvention is not limited thereto. Various changes may also be made inthe design and arrangement of the parts without departing from thespirit and scope of the invention as the same will now be understood bythose skilled in the art.

What is claimed is:

1. Apparatus for monitoring pairs of redundant signals at a plurality ofpoints in a control system comprising:

a plurality of switching means, each of which is connected to acorresponding point in the control system; monitor connected to theplurality of switching means, with one of said switching means beinginitially effective for applying a corresponding pair of redundantsignals to the monitor, said monitor providing an alternating output ifthe signals in said pair correspond within predetermined limits; acounter connected to the monitor and responsive to the alternatingoutput from sequencing from an initial logic state to another logicstate and for providing an output corresponding to said other logicstate;

a decoder connected to the counter and responsive to the outputcorresponding to the other logic state for providing a controllingoutput; and

the plurality of switching means connected to the decoder, with anotherone of said switching means affected by the controlling output forsequentially applying a corresponding pair of redundant signals to themonitor.

2. Apparatus as described in claim 1, wherein:

the monitor provides a constant level output if the signals in said pairdo not correspond within the predetermined limits, said constant leveloutput being ineffective for sequencing the counter from the initiallogic state to the other logic state, whereupon the decoder is renderedineffective for providing the controlling output.

3. Apparatus as described by claim 1, including:

utilizing means connected to the monitor for utilizing the constantlevel output to render the control system in a failure mode.

4. Apparatus as described by claim 2, including:

means for providing a signal at a predetermined level;

a switching device connected to the predetermined level signal means andto the monitor;

gating means connected to the counter, to the decoder, to the monitor,to a predetermined switching means of the plurality of switching meansand to the switching device, and affected by the predetermined levelsignal, the controlling output and the alternating output for renderingthe predetermined switching means ineffective for applying acorresponding pair of redundant signals to the monitor, and forrendering the switching device effective for applying the signal at apredetermined level to the monitor; and

said monitor being responsive to the predetermined level signal forproviding the alternating output.

5. Apparatus as described by claim 1, wherein each of the switchingmeans in the plurality of switching means includes:

a current flow control device having an input element, an output elementand a control element; the input element connected to the correspondingpoint in the control system;

the monitor connected to the output element; and

the control element connected to the decoder.

6. Apparatus as described by claim 4, wherein the switching deviceincludes:

a current flow control device having an input element, an output elementand a control element; the input element connected to the means forproviding a signal at a predetermined level;

the output element connected to the monitor; and

the gating means connected to the control element.

7. Apparatus as described by claim 5, including:

a source of constant level voltage connected to the input element of thecurrent flow control device.

8. Apparatus as described by claim 1, wherein the counter includes:

dual flip-flops, each of which has a pair of input terminals, a pair ofoutput terminals, a biasing terminal, a clock terminal and a resetterminal;

the input terminals of each of the dual flip-flops connected to theoutput terminals of the other of said flip-flops;

the monitor connected to the clock terminals of each of the flip-flops;

a source of constant level voltage connected to the biasing terminal ofeach of the flip-flops',

a pulse source connected to the reset terminals of each of theflip-flops; and

each of the dual flip-flops being responsive to the constant levelvoltage, the alternating monitor output and the pulses from the pulsesource for providing at its output terminals outputs at one logic leveland at another logic level.

9. Apparatus as described by claim 8, wherein the decoder includes:

a plurality of gates each of which has a pair of input terminalsconnected to appropriate output terminals of the flip-flops forreceiving predetermined combinations of logic outputs thereat, and anoutput terminal connected to a corresponding switching means forapplying the controlling output thereto.

10. Apparatus as described by claim 4, wherein the gating meansincludes:

first means connected to the monitor and responsive fourth meansconnected to the third means and to to the constant level signal foralternately providthe decoder and affected by the sixth signal and ingfirst and second signals; the controlling output from the decoderprovided second means connected to the counter and afi'ected when themonitor provides the alternating output by the counter in the initiallogic state for provid- 5 for pr viding a seventh output for renderingthe ing a third signal at a first output terminal; predeterminedswitching means ineffective for apthird means connected to the firstmeans and to the plying a corresponding pairof redundant signals tosecond means and responsive to the first, second the Qf i f p f g anelglfth Output for and third signals for alternately providing fourth fthe swltchmg devlce effective for pp yand fifth signals, said fourth andfifth signals affectmg the 8 at a predetermmed level to ing said secondmeans for providing a sixth signal; and 1

1. Apparatus for monitoring pairs of redundant signals at a plurality ofpoints in a control system comprising: a plurality of switching means,each of which is connected to a corresponding point in the controlsystem; a monitor connected to the plurality of switching means, withone of said switching means being initially effective for applying acorresponding pair of redundant signals to the monitor, said monitorproviding an alternating output if the signals in said pair correspondwithin predetermined limits; a counter connected to the monitor andresponsive to the alternating output from sequencing from an initiallogic state to another logic state and for providing an outputcorresponding to said other logic state; a decoder connected to thecounter and responsive to the output corresponding to the other logicstate for providing a controlling output; and the plurality of switchingmeans connected to the decoder, with another one of said switching meansaffected by the controlling output for sequentially applying acorresponding pair of redundant signals to the monitor.
 2. Apparatus asdescribed in claim 1, wherein: the monitor provides a constant leveloutput if the signals in said pair do not correspond within thepredetermined limits, said constant level output being ineffective forsequencing the counter from the initial logic state to the other logicstate, whereupon the decoder is rendered ineffective for providing thecontrolling output.
 3. Apparatus as described by claim 1, including:utilizing means connected to the monitor for utilizing the constantlevel output to render the control system in a failure mode. 4.Apparatus as described by claim 2, including: means for providing asignal at a predetermined level; a switching device connected to thepredetermined level signal means and to the monitor; gating meansconnected to the counter, to the decoder, to the monitor, to apredetermined switching means of the plurality of switching means and tothe switching device, and affected by the predetermined level signal,the controlling output and the alternating output for rendering thepredetermined switching means ineffective for applying a correspondingpair of redundant signals to the monitor, and for rendering theswitching device effective for applying the signal at a predeterminedlevel to the monitor; and said monitor being responsive to thepredetermined level signal for providing the alternating output. 5.Apparatus as described by claim 1, wherein each of the switching meansin the plurality of switching means includes: a current flow controldevice having an input element, an output element and a control element;the input element connected to the corresponding point in the controlsystem; the monitor connected to the output element; and the controlelement connected to the decoder.
 6. Apparatus as described by claim 4,wherein the switching device includes: a current flow control devicehaving an input element, an output element and a control element; theinput element connected to the means for providing a signal at apredetermined level; the output element connected to the monitor; andthe gating means connected to the control element.
 7. Apparatus asdescribed by claim 5, including: a source of coNstant level voltageconnected to the input element of the current flow control device. 8.Apparatus as described by claim 1, wherein the counter includes: dualflip-flops, each of which has a pair of input terminals, a pair ofoutput terminals, a biasing terminal, a clock terminal and a resetterminal; the input terminals of each of the dual flip-flops connectedto the output terminals of the other of said flip-flops; the monitorconnected to the clock terminals of each of the flip-flops; a source ofconstant level voltage connected to the biasing terminal of each of theflip-flops; a pulse source connected to the reset terminals of each ofthe flip-flops; and each of the dual flip-flops being responsive to theconstant level voltage, the alternating monitor output and the pulsesfrom the pulse source for providing at its output terminals outputs atone logic level and at another logic level.
 9. Apparatus as described byclaim 8, wherein the decoder includes: a plurality of gates each ofwhich has a pair of input terminals connected to appropriate outputterminals of the flip-flops for receiving predetermined combinations oflogic outputs thereat, and an output terminal connected to acorresponding switching means for applying the controlling outputthereto.
 10. Apparatus as described by claim 4, wherein the gating meansincludes: first means connected to the monitor and responsive to theconstant level signal for alternately providing first and secondsignals; second means connected to the counter and affected by thecounter in the initial logic state for providing a third signal at afirst output terminal; third means connected to the first means and tothe second means and responsive to the first, second and third signalsfor alternately providing fourth and fifth signals, said fourth andfifth signals affecting said second means for providing a sixth signal;and fourth means connected to the third means and to the decoder andaffected by the sixth signal and the controlling output from the decoderprovided when the monitor provides the alternating output for providinga seventh output for rendering the predetermined switching meansineffective for applying a corresponding pair of redundant signals tothe monitor, and for providing an eighth output for rendering theswitching device effective for applying the signal at a predeterminedlevel to the monitor.